@lensmcp/cluster 1.18.4 → 1.18.7

package/executors/gateway/main.prod-gateway.js

@@ -1,573 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-/**
- * Production gateway process entry — the thing the Docker image runs. Reads
- * its whole configuration from the environment (12-factor) and composes
- * `startProdGateway` with the file-backed manifest provider + endpoint pod
- * provider. Stateless and replica-safe.
- *
- * Env:
- *   LENSMCP_GW_PORTS         csv of ports (default "8080", or "8443" with TLS)
- *   LENSMCP_GW_WORKERS       cluster worker processes for multi-core (default 1; "auto"/"max" =
- *                            os.cpus().length). Each worker shares the port. SECURITY: with the
- *                            IN-MEMORY rate limiter the limit is enforced PER WORKER (~N×) — set
- *                            LENSMCP_GW_RATE_LIMIT_REDIS=1 (one shared budget) when running >1 worker.
- *   LENSMCP_GW_MANIFESTS     path to a manifests JSON file (array or {manifests:[]})
- *   LENSMCP_GW_ENDPOINTS     path to an endpoints JSON for gateway-side LB / rollout
- *                           (only needed for services whose manifest has no `upstream`).
- *                           Flat:    {service:[url,...]}
- *                           Rollout: {service:[{version,weight,urls:[url,...]}]}  ← weighted
- *                           split across version cohorts; file is watched so weight
- *                           changes ramp/rollback traffic LIVE (no redeploy).
- *   LENSMCP_GW_KEYS          path to a {service: x-internal-token} JSON (the trust registry)
- *   LENSMCP_GW_TLS_KEY       path to TLS private key PEM (enables https)
- *   LENSMCP_GW_TLS_CERT      path to TLS cert PEM
- *   jwt routes ALWAYS require auth: validated against the verifier (JWKS/HS256) when
- *   configured, else FAIL CLOSED (401). LENSMCP_GW_JWT_PRESENCE_ONLY=1 opts into a
- *   weak bearer-presence-only edge guard when no verifier is wired (not recommended).
- *   LENSMCP_EVENT_FILE       set → enable the lens bus (OPT-IN; off by default)
- *
- *   Targeted rollout (attribute-based routing; docs/design/targeted-rollout.md):
- *   LENSMCP_GW_ENDPOINTS     also accepts the targeted shape per service:
- *                           {service:{rules:[{name,when,version}],cohorts:[…]}}
- *   LENSMCP_GW_JWT_SECRET    HS256 secret → identify() exposes VERIFIED claims as
- *                           rule attributes (sub/email/tenant/roles…). RS256/JWKS = prod upgrade.
- *   LENSMCP_GW_ATTR_HEADERS  csv of request headers exposed to rules as `header.<name>`
- *   LENSMCP_GW_TRUST_PROXY   "1" → take the `ip` attribute from X-Forwarded-For (behind an LB)
- *   LENSMCP_GW_UID_HEADER    header carrying a device/user id — sticky key when no cookie
- *   LENSMCP_GW_COOKIE_SECRET set → enable the HMAC-signed device cookie (sticky bucketing)
- *   LENSMCP_GW_COOKIE_NAME   device cookie name (default "lensmcp_did")
- *   LENSMCP_GW_COOKIE_DOMAIN cookie Domain (e.g. ".tetros.ai" to span subdomains)
- *   LENSMCP_GW_COOKIE_MAXAGE cookie Max-Age seconds (default 31536000)
- *
- *   Edge tuning (all optional — lib defaults are production-shaped):
- *   PORT                     platform-injected bind port (used when LENSMCP_GW_PORTS is unset)
- *   LENSMCP_GW_ACCESS_LOG    "1" → one Cloud-Logging-shaped JSON line per request to stdout
- *   LENSMCP_GW_UPSTREAM_TLS_VERIFY "1" → verify upstream TLS certs (set for east-west on GCP;
- *                           default off keeps local-CA / self-signed upstreams working)
- *   LENSMCP_GW_UPSTREAM_H2    "1" → HTTP/2 to upstreams (multiplex many MCP streams; Cloud Run speaks h2).
- *                           Auto-on when mTLS is configured; set "0" to force h1.1.
- *   mTLS to upstreams (optional client cert; rides on h2). Server validation is the
- *   LENSMCP_GW_UPSTREAM_TLS_VERIFY toggle above ("option to not validate" = leave it off):
- *   LENSMCP_GW_MTLS_FROM_REDIS "1" → load cert/key/ca from shared Redis keys
- *                           <prefix>:mtls:{cert,key,ca} (rotate by writing Redis; rolling-restart to apply)
- *   LENSMCP_GW_MTLS_CERT / _KEY / _CA  PEM file paths (used when not loading from Redis)
- *   LENSMCP_GW_CLIENT_IP_HEADER  header with the authoritative client IP from the front
- *                           proxy (set `cf-connecting-ip` behind Cloudflare; feeds IP-based ABAC)
- *   LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES  csv of CIDRs allowed to set that header
- *                           (default loopback only — prevents off-proxy IP spoofing)
- *   LENSMCP_GW_UNDICI_CONNECTIONS    per-origin connection pool size (default 256; RIGHT-SIZE to the
- *                                    upstream latency — fewer is faster for a fast/local upstream)
- *   LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS undici response-body timeout; default 0 = unlimited
- *   LENSMCP_GW_UNDICI_PIPELINING     requests packed per upstream connection (default 1; >1 lifts
- *                                    throughput on uniformly-fast upstreams but risks head-of-line
- *                                    blocking on streaming responses — leave 1 for mixed traffic)
- *   LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS upstream response-headers timeout (default 60000)
- *   LENSMCP_GW_UNDICI_KEEPALIVE_MS   undici per-origin keep-alive timeout (default 60000)
- *                           (keeps long-lived SSE / streaming MCP responses open)
- *   LENSMCP_GW_KEEPALIVE_MS  server keep-alive timeout; default 620000, kept ABOVE the GCP
- *                           external ALB's 600s backend keep-alive (avoids intermittent 502s)
- *   LENSMCP_GW_REQUEST_TIMEOUT_MS inbound request timeout; default 0 = disabled (streaming)
- *
- *   Distributed tracing (OpenTelemetry — on only when the OTLP endpoint is set):
- *   OTEL_EXPORTER_OTLP_ENDPOINT  OTLP/HTTP endpoint (Cloud Trace / Collector / X-Ray / Tempo / Jaeger).
- *                           Set → gateway emits a SERVER span per request + propagates W3C traceparent downstream.
- *   OTEL_SERVICE_NAME        resource service.name (default "lensmcp-gateway")
- *   OTEL_EXPORTER_OTLP_HEADERS   exporter auth headers (standard OTLP env, read by the exporter)
- *   LENSMCP_GW_OTEL_SAMPLE   head sample ratio 0..1 for root spans (default 1)
- *
- *   Status rollup (for a status page — observed health, not the routing registry):
- *   LENSMCP_GW_STATUS        "1" → expose GET /statusz + (with Redis) fan health to status:<svc>:<instance>
- *   LENSMCP_GW_STATUS_TOKEN  if set, /statusz (and /metricsz) require ?token= or x-status-token to match
- *   LENSMCP_GW_METRICS       "1" → expose token-gated /metricsz (event-loop lag / rss / cpu / req rates) for load tests
- *
- *   Active health-checking (probe upstreams; route pools around dead endpoints):
- *   LENSMCP_GW_HEALTH_CHECK  "1" → probe every upstream and steer pooled picks to healthy ones
- *   LENSMCP_GW_HEALTH_PATH   probe path (default /healthz); healthy = answers with status < 500
- *   LENSMCP_GW_HEALTH_INTERVAL_MS / LENSMCP_GW_HEALTH_TIMEOUT_MS  probe period / timeout
- *
- *   Rate limit (opt-in, per client IP; defense-in-depth behind the edge throttle):
- *   LENSMCP_GW_RATE_LIMIT    requests allowed per window (enables the limiter)
- *   LENSMCP_GW_RATE_WINDOW_MS window the limit refills over (default 60000)
- *   LENSMCP_GW_RATE_LIMIT_REDIS  "1" → ONE GLOBAL budget across all containers via the
- *                           shared registry Redis (atomic Lua token-bucket); else per-instance
- *   LENSMCP_GW_RATE_LIMIT_REDIS_URL  dedicated Redis for the limiter (else reuse the registry one)
- *   LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS  per-request Redis budget before the fail policy (default 100)
- *   LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED "1" → deny on a Redis error/timeout (default: fail OPEN)
- *
- * Manifests + endpoints + keys are FILE-backed here; a registry-backed
- * ManifestProvider (Redis/ConfigMap) drops in behind the same interface.
- */
-const node_fs_1 = require("node:fs");
-const node_crypto_1 = require("node:crypto");
-const node_path_1 = require("node:path");
-const node_os_1 = require("node:os");
-const node_cluster_1 = tslib_1.__importDefault(require("node:cluster"));
-const prod_gateway_lib_1 = require("./prod-gateway.lib");
-const jwks_verify_1 = require("./jwks-verify");
-const otel_tracing_1 = require("./otel-tracing");
-const health_check_1 = require("./health-check");
-const rate_limit_1 = require("./rate-limit");
-const metrics_1 = require("./metrics");
-const registry_source_1 = require("./registry-source");
-const providers_prod_1 = require("./providers-prod");
-function readJson(path, fallback) {
-    if (!path)
-        return fallback;
-    try {
-        return JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
-    }
-    catch (e) {
-        console.error(`[gateway] could not read ${path}:`, e.message);
-        return fallback;
-    }
-}
-/** Endpoints file is either flat `{svc:[url]}` or rollout `{svc:[{version,weight,urls}]}`. */
-function isCohortShape(eps) {
-    const first = Object.values(eps)[0];
-    return Array.isArray(first) && first.length > 0 && typeof first[0] === 'object' && first[0] !== null && 'urls' in first[0];
-}
-/** Poll a JSON file and invoke `onChange` with its parsed contents whenever it
- *  changes — drives LIVE rollout ramps (edit weights → traffic shifts, no
- *  redeploy). Returns a stop fn. */
-function watchJsonFile(path, onChange, pollMs = 1000) {
-    let mtime = -1;
-    const tick = () => {
-        if (!(0, node_fs_1.existsSync)(path))
-            return;
-        let m;
-        try {
-            m = (0, node_fs_1.statSync)(path).mtimeMs;
-        }
-        catch {
-            return;
-        }
-        if (m === mtime)
-            return;
-        let data;
-        try {
-            data = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
-        }
-        catch (e) {
-            console.error('[gateway] endpoints reload:', e.message);
-            return;
-        }
-        mtime = m;
-        onChange(data);
-    };
-    const timer = setInterval(tick, pollMs);
-    timer.unref?.();
-    return () => clearInterval(timer);
-}
-async function main() {
-    const env = process.env;
-    // Bind ports: explicit LENSMCP_GW_PORTS wins; else honor the platform `PORT`
-    // contract (Cloud Run / buildpacks inject it); else the lib default (8080/8443).
-    const ports = (env['LENSMCP_GW_PORTS'] ?? env['PORT'] ?? '').split(',').map((s) => Number(s.trim())).filter(Boolean);
-    // Process-level safety net: a single uncaught async error must not kill the
-    // pod and 503 every in-flight request — log and keep serving.
-    process.on('uncaughtException', (err) => console.error('[gateway] uncaughtException:', err));
-    process.on('unhandledRejection', (reason) => console.error('[gateway] unhandledRejection:', reason));
-    // Config source: a Redis REGISTRY (zero-touch auto-sync — a deploy / the
-    // `lensmcp rollout --redis` helper writes keys + publishes, gateway re-reads
-    // live) takes precedence; otherwise file-backed manifests + endpoints (watched).
-    const redisUrl = env['LENSMCP_GW_REDIS_URL'];
-    let manifests;
-    let pods;
-    let stopEndpointsWatch;
-    let registry;
-    // Reused (when present) for the status:* fan-out and shared mTLS material reads.
-    let redisClient;
-    if (redisUrl) {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const Redis = require('ioredis');
-        const client = new Redis(redisUrl);
-        redisClient = client;
-        const reg = (0, registry_source_1.createRegistryProviders)((0, registry_source_1.redisRegistrySource)(client, env['LENSMCP_GW_REDIS_PREFIX'] ? { prefix: env['LENSMCP_GW_REDIS_PREFIX'] } : {}), { onError: (e) => console.error('[gateway] registry:', e instanceof Error ? e.message : e) });
-        await reg.start(); // warm the route table before serving
-        manifests = reg.manifests;
-        pods = reg.pods;
-        registry = reg;
-        console.log(`[gateway] registry: Redis-backed, live (${manifests.list().length} service(s))`);
-    }
-    else {
-        const manifestFile = env['LENSMCP_GW_MANIFESTS'];
-        if (manifestFile) {
-            manifests = (0, providers_prod_1.fileManifestProvider)(manifestFile, { onError: (e) => console.error('[gateway] manifest:', e instanceof Error ? e.message : e) });
-        }
-        else {
-            console.warn('[gateway] no LENSMCP_GW_MANIFESTS / LENSMCP_GW_REDIS_URL — starting with an EMPTY route table (all requests 404 until manifests arrive).');
-            manifests = (0, providers_prod_1.staticManifestProvider)([]);
-        }
-        // Endpoints drive gateway-side LB / progressive rollout. Shapes:
-        //   flat     {svc:[url,...]}                       → endpointsPodProvider
-        //   rollout  {svc:[{version,weight,urls:[...]}]}   → rolloutPodProvider (weighted split)
-        //   targeted {svc:{rules,cohorts}}                 → rolloutPodProvider (ABAC)
-        // The file is watched so weights ramp or roll back LIVE — no gateway redeploy.
-        const endpointsFile = env['LENSMCP_GW_ENDPOINTS'];
-        const endpointsRaw = readJson(endpointsFile, {});
-        if (Object.keys(endpointsRaw).length) {
-            const rollout = isCohortShape(endpointsRaw);
-            pods = rollout
-                ? (0, providers_prod_1.rolloutPodProvider)(endpointsRaw)
-                : (0, providers_prod_1.endpointsPodProvider)(endpointsRaw);
-            console.log(`[gateway] endpoints: ${rollout ? 'ROLLOUT (weighted cohorts)' : 'flat'} — ${Object.keys(endpointsRaw).length} service(s)`);
-            if (endpointsFile) {
-                stopEndpointsWatch = watchJsonFile(endpointsFile, (next) => {
-                    try {
-                        pods?.update?.(next);
-                        console.log('[gateway] endpoints reloaded');
-                    }
-                    catch (e) {
-                        console.error('[gateway] endpoints reload failed:', e.message);
-                    }
-                });
-            }
-        }
-    }
-    const serviceKeys = readJson(env['LENSMCP_GW_KEYS'], {});
-    const tls = env['LENSMCP_GW_TLS_KEY'] && env['LENSMCP_GW_TLS_CERT']
-        ? { key: (0, node_fs_1.readFileSync)(env['LENSMCP_GW_TLS_KEY']), cert: (0, node_fs_1.readFileSync)(env['LENSMCP_GW_TLS_CERT']) }
-        : undefined;
-    // ── JWT verification: JWKS (RS256, prod) preferred, HS256 secret as fallback ──
-    // One verifier powers BOTH identify() (claims → ABAC attributes) and the edge
-    // authenticate(). A `jwt` route with NO verifier configured FAILS CLOSED (401),
-    // unless LENSMCP_GW_JWT_PRESENCE_ONLY=1 explicitly opts into a weak bearer-presence
-    // edge guard (no signature check). Default is fail-closed, not pass-through.
-    const jwtPresenceOnly = env['LENSMCP_GW_JWT_PRESENCE_ONLY'] === '1';
-    const jwksUrl = env['LENSMCP_GW_JWKS_URL'];
-    const jwtSecret = env['LENSMCP_GW_JWT_SECRET'];
-    const jwks = jwksUrl
-        ? (0, jwks_verify_1.createJwksVerifier)({
-            jwksUrl,
-            ...(env['LENSMCP_GW_JWT_ISS'] ? { issuer: env['LENSMCP_GW_JWT_ISS'] } : {}),
-            ...(env['LENSMCP_GW_JWT_AUD'] ? { audience: env['LENSMCP_GW_JWT_AUD'].split(',').map((s) => s.trim()) } : {}),
-        })
-        : undefined;
-    const hs256 = (tok) => {
-        if (!jwtSecret)
-            return undefined;
-        const parts = tok.split('.');
-        if (parts.length !== 3)
-            return undefined;
-        try {
-            const expect = (0, node_crypto_1.createHmac)('sha256', jwtSecret).update(parts[0] + '.' + parts[1]).digest('base64url');
-            const a = Buffer.from(parts[2]), b = Buffer.from(expect);
-            if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b))
-                return undefined;
-            const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-            if (typeof payload.exp === 'number' && Date.now() / 1000 > payload.exp)
-                return undefined;
-            return payload;
-        }
-        catch {
-            return undefined;
-        }
-    };
-    const bearerClaims = (req) => {
-        const auth = String(req.headers['authorization'] ?? '');
-        if (!auth.startsWith('Bearer '))
-            return undefined;
-        const tok = auth.slice(7);
-        return jwks ? jwks.verify(tok) : hs256(tok);
-    };
-    const identify = (jwks || jwtSecret) ? bearerClaims : undefined;
-    const authenticate = (mode, req) => {
-        if (mode !== 'jwt')
-            return;
-        if (jwks || jwtSecret) {
-            if (!bearerClaims(req))
-                throw new Error('invalid or missing token');
-            return;
-        } // real verification
-        // No verifier configured → FAIL CLOSED, unless presence-only is explicitly opted in.
-        if (!jwtPresenceOnly)
-            throw new Error('jwt route but no verifier configured (set LENSMCP_GW_JWKS_URL or LENSMCP_GW_JWT_SECRET)');
-        if (!String(req.headers['authorization'] ?? '').startsWith('Bearer '))
-            throw new Error('missing bearer token');
-    };
-    const attributeHeaders = (env['LENSMCP_GW_ATTR_HEADERS'] ?? '').split(',').map((s) => s.trim()).filter(Boolean);
-    const trustProxyIp = env['LENSMCP_GW_TRUST_PROXY'] === '1';
-    const uidHeader = env['LENSMCP_GW_UID_HEADER'];
-    const cookie = (env['LENSMCP_GW_COOKIE_SECRET'] || env['LENSMCP_GW_COOKIE_NAME'] || env['LENSMCP_GW_COOKIE_DOMAIN'])
-        ? {
-            ...(env['LENSMCP_GW_COOKIE_NAME'] ? { name: env['LENSMCP_GW_COOKIE_NAME'] } : {}),
-            ...(env['LENSMCP_GW_COOKIE_SECRET'] ? { secret: env['LENSMCP_GW_COOKIE_SECRET'] } : {}),
-            ...(env['LENSMCP_GW_COOKIE_DOMAIN'] ? { domain: env['LENSMCP_GW_COOKIE_DOMAIN'] } : {}),
-            ...(env['LENSMCP_GW_COOKIE_MAXAGE'] ? { maxAge: Number(env['LENSMCP_GW_COOKIE_MAXAGE']) } : {}),
-        }
-        : undefined;
-    // Lens bus is OPT-IN: only when LENSMCP_EVENT_FILE is set do we attach a sink.
-    const eventFile = env['LENSMCP_EVENT_FILE'];
-    let dirReady = false;
-    const emit = eventFile
-        ? (event) => {
-            try {
-                if (!dirReady) {
-                    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(eventFile), { recursive: true });
-                    dirReady = true;
-                }
-                (0, node_fs_1.appendFileSync)(eventFile, JSON.stringify(event) + '\n');
-            }
-            catch { /* lens offline — never block traffic */ }
-        }
-        : undefined;
-    // Warm the JWKS before serving so the first identity-routed requests have keys.
-    if (jwks) {
-        try {
-            await jwks.refresh();
-            console.log('[gateway] JWKS loaded');
-        }
-        catch (e) {
-            console.error('[gateway] initial JWKS load failed (will retry in background):', e.message);
-        }
-    }
-    // ── edge tuning (all optional; sensible prod defaults live in the lib) ──
-    const accessLog = env['LENSMCP_GW_ACCESS_LOG'] === '1';
-    const clientIpHeader = env['LENSMCP_GW_CLIENT_IP_HEADER']; // e.g. cf-connecting-ip behind Cloudflare
-    // CIDRs of trusted front proxies that may set the client-IP header (default: loopback only).
-    const clientIpTrustedProxies = (env['LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES'] ?? '').split(',').map((s) => s.trim()).filter(Boolean);
-    const undici = {};
-    if (env['LENSMCP_GW_UPSTREAM_TLS_VERIFY'] === '1')
-        undici.rejectUnauthorized = true; // "option to not validate" = leave unset
-    if (env['LENSMCP_GW_UPSTREAM_H2'] === '1')
-        undici.allowH2 = true;
-    if (env['LENSMCP_GW_UNDICI_CONNECTIONS'])
-        undici.connections = Number(env['LENSMCP_GW_UNDICI_CONNECTIONS']);
-    if (env['LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS'])
-        undici.bodyTimeout = Number(env['LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS']);
-    // Pipelining > 1 packs more requests per upstream connection (higher throughput on fast upstreams) but
-    // risks head-of-line blocking — a slow/streaming response stalls the requests queued behind it on that
-    // connection. Default 1 (safe for mixed/streaming traffic); raise only for uniformly-fast upstreams.
-    if (env['LENSMCP_GW_UNDICI_PIPELINING'])
-        undici.pipelining = Number(env['LENSMCP_GW_UNDICI_PIPELINING']);
-    if (env['LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS'])
-        undici.headersTimeout = Number(env['LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS']);
-    if (env['LENSMCP_GW_UNDICI_KEEPALIVE_MS'])
-        undici.keepAliveTimeout = Number(env['LENSMCP_GW_UNDICI_KEEPALIVE_MS']);
-    // ── mTLS client materials (optional): from the shared registry Redis, or files ──
-    if (env['LENSMCP_GW_MTLS_FROM_REDIS'] === '1' && redisClient) {
-        const p = env['LENSMCP_GW_REDIS_PREFIX'] ?? 'lensmcp:gw';
-        const [cert, key, ca] = await redisClient.mget(`${p}:mtls:cert`, `${p}:mtls:key`, `${p}:mtls:ca`);
-        if (cert)
-            undici.cert = cert;
-        if (key)
-            undici.key = key;
-        if (ca)
-            undici.ca = ca;
-        if (cert || key)
-            console.log('[gateway] mTLS materials loaded from Redis');
-    }
-    else {
-        if (env['LENSMCP_GW_MTLS_CERT'])
-            undici.cert = (0, node_fs_1.readFileSync)(env['LENSMCP_GW_MTLS_CERT']);
-        if (env['LENSMCP_GW_MTLS_KEY'])
-            undici.key = (0, node_fs_1.readFileSync)(env['LENSMCP_GW_MTLS_KEY']);
-        if (env['LENSMCP_GW_MTLS_CA'])
-            undici.ca = (0, node_fs_1.readFileSync)(env['LENSMCP_GW_MTLS_CA']);
-    }
-    // mTLS rides on HTTP/2 by default (unless explicitly disabled with LENSMCP_GW_UPSTREAM_H2=0).
-    if (undici.cert && undici.key) {
-        if (env['LENSMCP_GW_UPSTREAM_H2'] !== '0')
-            undici.allowH2 = true;
-        console.log(`[gateway] mTLS to upstreams ON over ${undici.allowH2 ? 'h2' : 'h1.1'} (server validation ${undici.rejectUnauthorized ? 'enabled' : 'OFF'})`);
-    }
-    const server = {};
-    if (env['LENSMCP_GW_KEEPALIVE_MS'])
-        server.keepAliveTimeout = Number(env['LENSMCP_GW_KEEPALIVE_MS']);
-    if (env['LENSMCP_GW_REQUEST_TIMEOUT_MS'])
-        server.requestTimeout = Number(env['LENSMCP_GW_REQUEST_TIMEOUT_MS']);
-    // OTel distributed tracing — on only when OTEL_EXPORTER_OTLP_ENDPOINT is set.
-    const tracing = (0, otel_tracing_1.setupTracing)({
-        ...(env['OTEL_SERVICE_NAME'] ? { serviceName: env['OTEL_SERVICE_NAME'] } : {}),
-        ...(env['LENSMCP_GW_OTEL_SAMPLE'] ? { sampleRatio: Number(env['LENSMCP_GW_OTEL_SAMPLE']) } : {}),
-    });
-    if (tracing)
-        console.log(`[gateway] OTLP tracing on → ${env['OTEL_EXPORTER_OTLP_ENDPOINT']}`);
-    // Status rollup: /statusz endpoint (token-guarded) + a per-instance Redis
-    // `status:<service>:<host>` fan-out (TTL'd) that a status page reads with a
-    // read-only ACL scoped to `status:*` — never the routing control-plane keys.
-    const statusEnabled = env['LENSMCP_GW_STATUS'] === '1';
-    const statusToken = env['LENSMCP_GW_STATUS_TOKEN'];
-    const instance = (0, node_os_1.hostname)();
-    const statusTtl = Math.max(3, Math.ceil((Number(env['LENSMCP_GW_TRAFFIC_FLUSH_MS'] ?? 5000) / 1000) * 3));
-    const statusRedis = redisClient;
-    const onStatus = (statusEnabled && statusRedis)
-        ? (snapshot) => {
-            for (const s of snapshot) {
-                void statusRedis.set(`status:${s.service}:${instance}`, JSON.stringify({ ...s, instance, at: Date.now() }), 'EX', statusTtl).catch(() => undefined);
-            }
-        }
-        : undefined;
-    if (statusEnabled && !statusToken)
-        console.warn('[gateway] LENSMCP_GW_STATUS=1 but no LENSMCP_GW_STATUS_TOKEN — /statusz stays DISABLED (404) until a token is set (fail-closed). The Redis status:* fan-out still runs.');
-    if (statusEnabled)
-        console.log(`[gateway] status on — /statusz${statusToken ? '' : ' (endpoint disabled: no token)'}${onStatus ? ' + Redis status:* fan-out' : ''}`);
-    // Active upstream health-checking — probes upstreams, routes pools around dead
-    // endpoints, and feeds true liveness into /statusz. Default off (passive only).
-    const healthChecker = env['LENSMCP_GW_HEALTH_CHECK'] === '1'
-        ? (0, health_check_1.createHealthChecker)({
-            ...(env['LENSMCP_GW_HEALTH_PATH'] ? { path: env['LENSMCP_GW_HEALTH_PATH'] } : {}),
-            ...(env['LENSMCP_GW_HEALTH_INTERVAL_MS'] ? { intervalMs: Number(env['LENSMCP_GW_HEALTH_INTERVAL_MS']) } : {}),
-            ...(env['LENSMCP_GW_HEALTH_TIMEOUT_MS'] ? { timeoutMs: Number(env['LENSMCP_GW_HEALTH_TIMEOUT_MS']) } : {}),
-        })
-        : undefined;
-    if (healthChecker)
-        console.log(`[gateway] active health-checking on (path ${env['LENSMCP_GW_HEALTH_PATH'] ?? '/healthz'})`);
-    // Per-client-IP rate limit (opt-in; defense-in-depth behind Cloudflare/Cloud Armor).
-    // LENSMCP_GW_RATE_LIMIT_REDIS=1 makes it ONE GLOBAL budget shared by every gateway
-    // container (atomic Lua token-bucket on the shared registry Redis — or a dedicated
-    // LENSMCP_GW_RATE_LIMIT_REDIS_URL); fail-open on a Redis blip. Otherwise it's the
-    // per-instance in-memory limiter (whose effective limit multiplies by container count).
-    let rateLimiter;
-    let rlRedisClient; // a dedicated client we own and must quit
-    if (env['LENSMCP_GW_RATE_LIMIT']) {
-        const limit = Number(env['LENSMCP_GW_RATE_LIMIT']);
-        const windowMs = Number(env['LENSMCP_GW_RATE_WINDOW_MS'] ?? 60_000);
-        const wantRedis = env['LENSMCP_GW_RATE_LIMIT_REDIS'] === '1' || !!env['LENSMCP_GW_RATE_LIMIT_REDIS_URL'];
-        if (wantRedis) {
-            const dedicatedUrl = env['LENSMCP_GW_RATE_LIMIT_REDIS_URL'];
-            let client;
-            if (dedicatedUrl) {
-                const Redis = require('ioredis');
-                rlRedisClient = new Redis(dedicatedUrl);
-                client = rlRedisClient;
-            }
-            else if (redisClient) {
-                client = redisClient; // reuse the registry Redis
-            }
-            if (client) {
-                const failClosed = env['LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED'] === '1';
-                rateLimiter = (0, rate_limit_1.createRedisRateLimiter)(client, {
-                    limit, windowMs,
-                    ...(env['LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS'] ? { timeoutMs: Number(env['LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS']) } : {}),
-                    ...(failClosed ? { failOpen: false } : {}),
-                });
-                console.log(`[gateway] rate limit on — ${limit} req / ${windowMs}ms GLOBAL (Redis: ${dedicatedUrl ? 'dedicated' : 'shared registry'}, fail-${failClosed ? 'closed' : 'open'}) per client IP`);
-            }
-            else {
-                console.warn('[gateway] LENSMCP_GW_RATE_LIMIT_REDIS set but no Redis configured (set LENSMCP_GW_REDIS_URL or LENSMCP_GW_RATE_LIMIT_REDIS_URL) — falling back to PER-INSTANCE in-memory limiting.');
-            }
-        }
-        if (!rateLimiter) {
-            rateLimiter = (0, rate_limit_1.createRateLimiter)({ limit, windowMs });
-            console.log(`[gateway] rate limit on — ${limit} req / ${windowMs}ms per client IP (in-memory, per-instance)`);
-        }
-    }
-    // Process self-metrics (event-loop lag / rss / cpu / req rates) for load tests + monitoring.
-    const metrics = env['LENSMCP_GW_METRICS'] === '1' ? (0, metrics_1.createProcessMetrics)() : undefined;
-    if (metrics)
-        console.log(`[gateway] process metrics on — /metricsz${statusToken ? ' (token-gated)' : ' (DISABLED: needs LENSMCP_GW_STATUS_TOKEN)'}`);
-    const handle = await (0, prod_gateway_lib_1.startProdGateway)({
-        ...(ports.length ? { ports } : {}),
-        manifests,
-        ...(pods ? { pods } : {}),
-        serviceKeys,
-        authenticate,
-        ...(tls ? { tls } : {}),
-        ...(emit ? { emit } : {}),
-        ...(identify ? { identify } : {}),
-        ...(attributeHeaders.length ? { attributeHeaders } : {}),
-        ...(trustProxyIp ? { trustProxyIp } : {}),
-        ...(cookie ? { cookie } : {}),
-        ...(uidHeader ? { uidHeader } : {}),
-        ...(accessLog ? { accessLog: true } : {}),
-        ...(clientIpHeader ? { clientIpHeader } : {}),
-        ...(clientIpTrustedProxies.length ? { clientIpTrustedProxies } : {}),
-        ...(tracing ? { tracing } : {}),
-        ...(statusEnabled ? { statusEndpoint: true } : {}),
-        ...(statusToken ? { statusToken } : {}),
-        ...(onStatus ? { onStatus } : {}),
-        ...(healthChecker ? { healthChecker } : {}),
-        ...(rateLimiter ? { rateLimiter } : {}),
-        ...(metrics ? { metrics } : {}),
-        ...(env['LENSMCP_GW_TRAFFIC_FLUSH_MS'] ? { trafficFlushMs: Number(env['LENSMCP_GW_TRAFFIC_FLUSH_MS']) } : {}),
-        ...(Object.keys(undici).length ? { undici } : {}),
-        ...(Object.keys(server).length ? { server } : {}),
-    });
-    console.log(`[gateway] production gateway up on ${handle.ports.join(', ')} (${handle.routes().length} routes${emit ? ', lens ON' : ''})`);
-    const shutdown = async (sig) => {
-        console.log(`[gateway] ${sig} — draining…`);
-        try {
-            manifests.stop?.();
-        }
-        catch { /* ignore */ }
-        try {
-            stopEndpointsWatch?.();
-        }
-        catch { /* ignore */ }
-        try {
-            registry?.stop();
-        }
-        catch { /* ignore */ }
-        try {
-            await rlRedisClient?.quit();
-        }
-        catch { /* ignore */ } // the dedicated rate-limit client we created (handle.stop() stops the limiter itself)
-        try {
-            jwks?.stop();
-        }
-        catch { /* ignore */ }
-        await handle.stop();
-        try {
-            await tracing?.shutdown();
-        }
-        catch { /* ignore */ } // flush buffered spans before exit
-        process.exit(0);
-    };
-    for (const sig of ['SIGTERM', 'SIGINT'])
-        process.on(sig, () => void shutdown(sig));
-}
-// ── Multi-core (opt-in via LENSMCP_GW_WORKERS) ──────────────────────────────
-// A single Node process is ONE thread; a high-RPS edge should use every core. `LENSMCP_GW_WORKERS`
-// forks N worker processes (default 1; `auto`/`max`/`0` ⇒ os.cpus().length). The PRIMARY only supervises
-// — fork, respawn on crash, propagate SIGTERM — while each WORKER runs the full gateway and shares the
-// listening port via Node's cluster module (connections round-robin across workers), so throughput scales
-// ~linearly with cores. NB: state is per-worker — use the Redis rate limiter + Redis status fan-out for
-// cross-worker consistency; a stateless route-and-forward proxy needs nothing extra.
-function workerCount() {
-    const v = (process.env['LENSMCP_GW_WORKERS'] ?? '1').trim().toLowerCase();
-    if (v === 'auto' || v === 'max' || v === '0')
-        return Math.max(1, (0, node_os_1.cpus)().length);
-    const n = Math.floor(Number(v));
-    return Number.isFinite(n) && n > 0 ? n : 1;
-}
-const WORKERS = workerCount();
-if (WORKERS > 1 && node_cluster_1.default.isPrimary) {
-    console.log(`[gateway] primary ${process.pid}: forking ${WORKERS} workers (one per core)…`);
-    // SECURITY: the in-memory rate limiter holds per-PROCESS buckets, so with N workers the effective
-    // global limit is ~N× the configured value (abuse/DoS protection is weakened). Use the Redis-backed
-    // limiter (one shared budget across workers) when running multi-core, or divide the per-worker limit.
-    if (process.env['LENSMCP_GW_RATE_LIMIT'] && !(process.env['LENSMCP_GW_RATE_LIMIT_REDIS'] === '1' || process.env['LENSMCP_GW_RATE_LIMIT_REDIS_URL'])) {
-        console.warn(`[gateway] WARNING: in-memory rate limiter + ${WORKERS} workers → the limit is enforced PER WORKER (effective ≈ ${WORKERS}× ${process.env['LENSMCP_GW_RATE_LIMIT']}/window). Set LENSMCP_GW_RATE_LIMIT_REDIS=1 for one shared global budget, or divide LENSMCP_GW_RATE_LIMIT by ${WORKERS}.`);
-    }
-    let stopping = false;
-    for (let i = 0; i < WORKERS; i++)
-        node_cluster_1.default.fork();
-    node_cluster_1.default.on('exit', (w, code, sig) => {
-        if (stopping)
-            return;
-        console.warn(`[gateway] worker ${w.process.pid} exited (code=${code} sig=${sig ?? ''}) — respawning.`);
-        node_cluster_1.default.fork();
-    });
-    const stopAll = (sig) => {
-        if (stopping)
-            return;
-        stopping = true;
-        console.log(`[gateway] primary: ${sig} — stopping ${Object.keys(node_cluster_1.default.workers ?? {}).length} workers…`);
-        for (const w of Object.values(node_cluster_1.default.workers ?? {})) {
-            try {
-                w?.kill(sig);
-            }
-            catch { /* gone */ }
-        }
-        setTimeout(() => process.exit(0), 12_000).unref(); // hard cap after workers drain
-    };
-    process.on('SIGTERM', () => stopAll('SIGTERM'));
-    process.on('SIGINT', () => stopAll('SIGINT'));
-}
-else {
-    // Worker (or single-process default): run the full gateway.
-    void main();
-}
+"use strict";var Q=Object.defineProperty;var L=(e,o)=>Q(e,"name",{value:o,configurable:!0});var X=Object.defineProperty,a=L((e,o)=>X(e,"name",{value:o,configurable:!0}),"a");Object.defineProperty(exports,"__esModule",{value:!0});const tslib_1=require("tslib"),node_fs_1=require("node:fs"),node_crypto_1=require("node:crypto"),node_path_1=require("node:path"),node_os_1=require("node:os"),node_cluster_1=tslib_1.__importDefault(require("node:cluster")),prod_gateway_lib_1=require("./prod-gateway.lib"),jwks_verify_1=require("./jwks-verify"),otel_tracing_1=require("./otel-tracing"),health_check_1=require("./health-check"),rate_limit_1=require("./rate-limit"),metrics_1=require("./metrics"),registry_source_1=require("./registry-source"),providers_prod_1=require("./providers-prod");function readJson(e,o){if(!e)return o;try{return JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(n){return console.error(`[gateway] could not read ${e}:`,n.message),o}}L(readJson,"readJson"),a(readJson,"readJson");function isCohortShape(e){const o=Object.values(e)[0];return Array.isArray(o)&&o.length>0&&typeof o[0]=="object"&&o[0]!==null&&"urls"in o[0]}L(isCohortShape,"isCohortShape"),a(isCohortShape,"isCohortShape");function watchJsonFile(e,o,n=1e3){let E=-1;const c=setInterval(a(()=>{if(!(0,node_fs_1.existsSync)(e))return;let N;try{N=(0,node_fs_1.statSync)(e).mtimeMs}catch{return}if(N===E)return;let u;try{u=JSON.parse((0,node_fs_1.readFileSync)(e,"utf8"))}catch(l){console.error("[gateway] endpoints reload:",l.message);return}E=N,o(u)},"tick"),n);return c.unref?.(),()=>clearInterval(c)}L(watchJsonFile,"watchJsonFile"),a(watchJsonFile,"watchJsonFile");async function main(){const e=process.env,o=(e.LENSMCP_GW_PORTS??e.PORT??"").split(",").map(t=>Number(t.trim())).filter(Boolean);process.on("uncaughtException",t=>console.error("[gateway] uncaughtException:",t)),process.on("unhandledRejection",t=>console.error("[gateway] unhandledRejection:",t));const n=e.LENSMCP_GW_REDIS_URL;let E,c,N,u,l;if(n){const t=require("ioredis"),r=new t(n);l=r;const _=(0,registry_source_1.createRegistryProviders)((0,registry_source_1.redisRegistrySource)(r,e.LENSMCP_GW_REDIS_PREFIX?{prefix:e.LENSMCP_GW_REDIS_PREFIX}:{}),{onError:a(s=>console.error("[gateway] registry:",s instanceof Error?s.message:s),"onError")});await _.start(),E=_.manifests,c=_.pods,u=_,console.log(`[gateway] registry: Redis-backed, live (${E.list().length} service(s))`)}else{const t=e.LENSMCP_GW_MANIFESTS;t?E=(0,providers_prod_1.fileManifestProvider)(t,{onError:a(s=>console.error("[gateway] manifest:",s instanceof Error?s.message:s),"onError")}):(console.warn("[gateway] no LENSMCP_GW_MANIFESTS / LENSMCP_GW_REDIS_URL \u2014 starting with an EMPTY route table (all requests 404 until manifests arrive)."),E=(0,providers_prod_1.staticManifestProvider)([]));const r=e.LENSMCP_GW_ENDPOINTS,_=readJson(r,{});if(Object.keys(_).length){const s=isCohortShape(_);c=s?(0,providers_prod_1.rolloutPodProvider)(_):(0,providers_prod_1.endpointsPodProvider)(_),console.log(`[gateway] endpoints: ${s?"ROLLOUT (weighted cohorts)":"flat"} \u2014 ${Object.keys(_).length} service(s)`),r&&(N=watchJsonFile(r,S=>{try{c?.update?.(S),console.log("[gateway] endpoints reloaded")}catch(P){console.error("[gateway] endpoints reload failed:",P.message)}}))}}const J=readJson(e.LENSMCP_GW_KEYS,{}),w=e.LENSMCP_GW_TLS_KEY&&e.LENSMCP_GW_TLS_CERT?{key:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_KEY),cert:(0,node_fs_1.readFileSync)(e.LENSMCP_GW_TLS_CERT)}:void 0,j=e.LENSMCP_GW_JWT_PRESENCE_ONLY==="1",O=e.LENSMCP_GW_JWKS_URL,I=e.LENSMCP_GW_JWT_SECRET,M=O?(0,jwks_verify_1.createJwksVerifier)({jwksUrl:O,...e.LENSMCP_GW_JWT_ISS?{issuer:e.LENSMCP_GW_JWT_ISS}:{},...e.LENSMCP_GW_JWT_AUD?{audience:e.LENSMCP_GW_JWT_AUD.split(",").map(t=>t.trim())}:{}}):void 0,x=a(t=>{if(!I)return;const r=t.split(".");if(r.length===3)try{const _=(0,node_crypto_1.createHmac)("sha256",I).update(r[0]+"."+r[1]).digest("base64url"),s=Buffer.from(r[2]),S=Buffer.from(_);if(s.length!==S.length||!(0,node_crypto_1.timingSafeEqual)(s,S))return;const P=JSON.parse(Buffer.from(r[1],"base64url").toString());return typeof P.exp=="number"&&Date.now()/1e3>P.exp?void 0:P}catch{return}},"hs256"),A=a(t=>{const r=String(t.headers.authorization??"");if(!r.startsWith("Bearer "))return;const _=r.slice(7);return M?M.verify(_):x(_)},"bearerClaims"),b=M||I?A:void 0,B=a((t,r)=>{if(t==="jwt"){if(M||I){if(!A(r))throw new Error("invalid or missing token");return}if(!j)throw new Error("jwt route but no verifier configured (set LENSMCP_GW_JWKS_URL or LENSMCP_GW_JWT_SECRET)");if(!String(r.headers.authorization??"").startsWith("Bearer "))throw new Error("missing bearer token")}},"authenticate"),v=(e.LENSMCP_GW_ATTR_HEADERS??"").split(",").map(t=>t.trim()).filter(Boolean),D=e.LENSMCP_GW_TRUST_PROXY==="1",U=e.LENSMCP_GW_UID_HEADER,k=e.LENSMCP_GW_COOKIE_SECRET||e.LENSMCP_GW_COOKIE_NAME||e.LENSMCP_GW_COOKIE_DOMAIN?{...e.LENSMCP_GW_COOKIE_NAME?{name:e.LENSMCP_GW_COOKIE_NAME}:{},...e.LENSMCP_GW_COOKIE_SECRET?{secret:e.LENSMCP_GW_COOKIE_SECRET}:{},...e.LENSMCP_GW_COOKIE_DOMAIN?{domain:e.LENSMCP_GW_COOKIE_DOMAIN}:{},...e.LENSMCP_GW_COOKIE_MAXAGE?{maxAge:Number(e.LENSMCP_GW_COOKIE_MAXAGE)}:{}}:void 0,g=e.LENSMCP_EVENT_FILE;let H=!1;const m=g?t=>{try{H||((0,node_fs_1.mkdirSync)((0,node_path_1.dirname)(g),{recursive:!0}),H=!0),(0,node_fs_1.appendFileSync)(g,JSON.stringify(t)+`
+`)}catch{}}:void 0;if(M)try{await M.refresh(),console.log("[gateway] JWKS loaded")}catch(t){console.error("[gateway] initial JWKS load failed (will retry in background):",t.message)}const V=e.LENSMCP_GW_ACCESS_LOG==="1",$=e.LENSMCP_GW_CLIENT_IP_HEADER,F=(e.LENSMCP_GW_CLIENT_IP_TRUSTED_PROXIES??"").split(",").map(t=>t.trim()).filter(Boolean),i={};if(e.LENSMCP_GW_UPSTREAM_TLS_VERIFY==="1"&&(i.rejectUnauthorized=!0),e.LENSMCP_GW_UPSTREAM_H2==="1"&&(i.allowH2=!0),e.LENSMCP_GW_UNDICI_CONNECTIONS&&(i.connections=Number(e.LENSMCP_GW_UNDICI_CONNECTIONS)),e.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS&&(i.bodyTimeout=Number(e.LENSMCP_GW_UNDICI_BODY_TIMEOUT_MS)),e.LENSMCP_GW_UNDICI_PIPELINING&&(i.pipelining=Number(e.LENSMCP_GW_UNDICI_PIPELINING)),e.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS&&(i.headersTimeout=Number(e.LENSMCP_GW_UNDICI_HEADERS_TIMEOUT_MS)),e.LENSMCP_GW_UNDICI_KEEPALIVE_MS&&(i.keepAliveTimeout=Number(e.LENSMCP_GW_UNDICI_KEEPALIVE_MS)),e.LENSMCP_GW_MTLS_FROM_REDIS==="1"&&l){const t=e.LENSMCP_GW_REDIS_PREFIX??"lensmcp:gw",[r,_,s]=await l.mget(`${t}:mtls:cert`,`${t}:mtls:key`,`${t}:mtls:ca`);r&&(i.cert=r),_&&(i.key=_),s&&(i.ca=s),(r||_)&&console.log("[gateway] mTLS materials loaded from Redis")}else e.LENSMCP_GW_MTLS_CERT&&(i.cert=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CERT)),e.LENSMCP_GW_MTLS_KEY&&(i.key=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_KEY)),e.LENSMCP_GW_MTLS_CA&&(i.ca=(0,node_fs_1.readFileSync)(e.LENSMCP_GW_MTLS_CA));i.cert&&i.key&&(e.LENSMCP_GW_UPSTREAM_H2!=="0"&&(i.allowH2=!0),console.log(`[gateway] mTLS to upstreams ON over ${i.allowH2?"h2":"h1.1"} (server validation ${i.rejectUnauthorized?"enabled":"OFF"})`));const d={};e.LENSMCP_GW_KEEPALIVE_MS&&(d.keepAliveTimeout=Number(e.LENSMCP_GW_KEEPALIVE_MS)),e.LENSMCP_GW_REQUEST_TIMEOUT_MS&&(d.requestTimeout=Number(e.LENSMCP_GW_REQUEST_TIMEOUT_MS));const W=(0,otel_tracing_1.setupTracing)({...e.OTEL_SERVICE_NAME?{serviceName:e.OTEL_SERVICE_NAME}:{},...e.LENSMCP_GW_OTEL_SAMPLE?{sampleRatio:Number(e.LENSMCP_GW_OTEL_SAMPLE)}:{}});W&&console.log(`[gateway] OTLP tracing on \u2192 ${e.OTEL_EXPORTER_OTLP_ENDPOINT}`);const G=e.LENSMCP_GW_STATUS==="1",C=e.LENSMCP_GW_STATUS_TOKEN,K=(0,node_os_1.hostname)(),Y=Math.max(3,Math.ceil(Number(e.LENSMCP_GW_TRAFFIC_FLUSH_MS??5e3)/1e3*3)),q=l,R=G&&q?t=>{for(const r of t)q.set(`status:${r.service}:${K}`,JSON.stringify({...r,instance:K,at:Date.now()}),"EX",Y).catch(()=>{})}:void 0;G&&!C&&console.warn("[gateway] LENSMCP_GW_STATUS=1 but no LENSMCP_GW_STATUS_TOKEN \u2014 /statusz stays DISABLED (404) until a token is set (fail-closed). The Redis status:* fan-out still runs."),G&&console.log(`[gateway] status on \u2014 /statusz${C?"":" (endpoint disabled: no token)"}${R?" + Redis status:* fan-out":""}`);const f=e.LENSMCP_GW_HEALTH_CHECK==="1"?(0,health_check_1.createHealthChecker)({...e.LENSMCP_GW_HEALTH_PATH?{path:e.LENSMCP_GW_HEALTH_PATH}:{},...e.LENSMCP_GW_HEALTH_INTERVAL_MS?{intervalMs:Number(e.LENSMCP_GW_HEALTH_INTERVAL_MS)}:{},...e.LENSMCP_GW_HEALTH_TIMEOUT_MS?{timeoutMs:Number(e.LENSMCP_GW_HEALTH_TIMEOUT_MS)}:{}}):void 0;f&&console.log(`[gateway] active health-checking on (path ${e.LENSMCP_GW_HEALTH_PATH??"/healthz"})`);let T,y;if(e.LENSMCP_GW_RATE_LIMIT){const t=Number(e.LENSMCP_GW_RATE_LIMIT),r=Number(e.LENSMCP_GW_RATE_WINDOW_MS??6e4);if(e.LENSMCP_GW_RATE_LIMIT_REDIS==="1"||e.LENSMCP_GW_RATE_LIMIT_REDIS_URL){const _=e.LENSMCP_GW_RATE_LIMIT_REDIS_URL;let s;if(_){const S=require("ioredis");y=new S(_),s=y}else l&&(s=l);if(s){const S=e.LENSMCP_GW_RATE_LIMIT_FAIL_CLOSED==="1";T=(0,rate_limit_1.createRedisRateLimiter)(s,{limit:t,windowMs:r,...e.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS?{timeoutMs:Number(e.LENSMCP_GW_RATE_LIMIT_TIMEOUT_MS)}:{},...S?{failOpen:!1}:{}}),console.log(`[gateway] rate limit on \u2014 ${t} req / ${r}ms GLOBAL (Redis: ${_?"dedicated":"shared registry"}, fail-${S?"closed":"open"}) per client IP`)}else console.warn("[gateway] LENSMCP_GW_RATE_LIMIT_REDIS set but no Redis configured (set LENSMCP_GW_REDIS_URL or LENSMCP_GW_RATE_LIMIT_REDIS_URL) \u2014 falling back to PER-INSTANCE in-memory limiting.")}T||(T=(0,rate_limit_1.createRateLimiter)({limit:t,windowMs:r}),console.log(`[gateway] rate limit on \u2014 ${t} req / ${r}ms per client IP (in-memory, per-instance)`))}const p=e.LENSMCP_GW_METRICS==="1"?(0,metrics_1.createProcessMetrics)():void 0;p&&console.log(`[gateway] process metrics on \u2014 /metricsz${C?" (token-gated)":" (DISABLED: needs LENSMCP_GW_STATUS_TOKEN)"}`);const h=await(0,prod_gateway_lib_1.startProdGateway)({...o.length?{ports:o}:{},manifests:E,...c?{pods:c}:{},serviceKeys:J,authenticate:B,...w?{tls:w}:{},...m?{emit:m}:{},...b?{identify:b}:{},...v.length?{attributeHeaders:v}:{},...D?{trustProxyIp:D}:{},...k?{cookie:k}:{},...U?{uidHeader:U}:{},...V?{accessLog:!0}:{},...$?{clientIpHeader:$}:{},...F.length?{clientIpTrustedProxies:F}:{},...W?{tracing:W}:{},...G?{statusEndpoint:!0}:{},...C?{statusToken:C}:{},...R?{onStatus:R}:{},...f?{healthChecker:f}:{},...T?{rateLimiter:T}:{},...p?{metrics:p}:{},...e.LENSMCP_GW_TRAFFIC_FLUSH_MS?{trafficFlushMs:Number(e.LENSMCP_GW_TRAFFIC_FLUSH_MS)}:{},...Object.keys(i).length?{undici:i}:{},...Object.keys(d).length?{server:d}:{}});console.log(`[gateway] production gateway up on ${h.ports.join(", ")} (${h.routes().length} routes${m?", lens ON":""})`);const z=a(async t=>{console.log(`[gateway] ${t} \u2014 draining\u2026`);try{E.stop?.()}catch{}try{N?.()}catch{}try{u?.stop()}catch{}try{await y?.quit()}catch{}try{M?.stop()}catch{}await h.stop();try{await W?.shutdown()}catch{}process.exit(0)},"shutdown");for(const t of["SIGTERM","SIGINT"])process.on(t,()=>{z(t)})}L(main,"main"),a(main,"main");function workerCount(){const e=(process.env.LENSMCP_GW_WORKERS??"1").trim().toLowerCase();if(e==="auto"||e==="max"||e==="0")return Math.max(1,(0,node_os_1.cpus)().length);const o=Math.floor(Number(e));return Number.isFinite(o)&&o>0?o:1}L(workerCount,"workerCount"),a(workerCount,"workerCount");const WORKERS=workerCount();if(WORKERS>1&&node_cluster_1.default.isPrimary){console.log(`[gateway] primary ${process.pid}: forking ${WORKERS} workers (one per core)\u2026`),process.env.LENSMCP_GW_RATE_LIMIT&&!(process.env.LENSMCP_GW_RATE_LIMIT_REDIS==="1"||process.env.LENSMCP_GW_RATE_LIMIT_REDIS_URL)&&console.warn(`[gateway] WARNING: in-memory rate limiter + ${WORKERS} workers \u2192 the limit is enforced PER WORKER (effective \u2248 ${WORKERS}\xD7 ${process.env.LENSMCP_GW_RATE_LIMIT}/window). Set LENSMCP_GW_RATE_LIMIT_REDIS=1 for one shared global budget, or divide LENSMCP_GW_RATE_LIMIT by ${WORKERS}.`);let e=!1;for(let n=0;n<WORKERS;n++)node_cluster_1.default.fork();node_cluster_1.default.on("exit",(n,E,c)=>{e||(console.warn(`[gateway] worker ${n.process.pid} exited (code=${E} sig=${c??""}) \u2014 respawning.`),node_cluster_1.default.fork())});const o=a(n=>{if(!e){e=!0,console.log(`[gateway] primary: ${n} \u2014 stopping ${Object.keys(node_cluster_1.default.workers??{}).length} workers\u2026`);for(const E of Object.values(node_cluster_1.default.workers??{}))try{E?.kill(n)}catch{}setTimeout(()=>process.exit(0),12e3).unref()}},"stopAll");process.on("SIGTERM",()=>o("SIGTERM")),process.on("SIGINT",()=>o("SIGINT"))}else main();